diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0485ab8..2e5a627 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -65,3 +65,27 @@ web/                   # SvelteKit frontend source
 - `main` is synced from `develop` via release tags
 - Never push directly to `develop` or `main`
 - Squash merge, delete branch after merge
+
+## CLA
+
+All contributions (code, docs, tests, configuration) require a signed
+Contributor License Agreement before a pull request can be merged:
+
+- 📋 **Individual?** → [Sign the Individual CLA](https://codecoradev.github.io/cla/?type=individual)
+- 🏢 **Contributing on behalf of a company?** → [Sign the Corporate CLA](https://codecoradev.github.io/cla/?type=corporate)
+
+The CLA is a license agreement, not a copyright assignment — you keep
+ownership of your work. Signing takes a couple of minutes and is stored
+in the [codecoradev/.github](https://github.com/codecoradev/.github)
+repository; a bot checks it automatically on every pull request.
+
+## Contributions are unpaid
+
+Contributing to this project is **voluntary and unpaid**. There is no
+compensation, payment, bounty, or financial reward of any kind for
+contributions — now or in the future. You contribute on your own time,
+at your own discretion, because you want to improve the project.
+
+If any paid-contribution program is ever introduced, it will be announced
+explicitly and this document will be updated. Until then, assume every
+contribution is volunteer work under the Apache-2.0 license terms above.